Terms of use of the site

POLICY

on the processing of personal data at the Limited Liability Company "Volga Trading Company"

The present Policy on the processing of personal data (hereinafter referred to as the Policy) at the Limited Liability Company "Volga Trading Company" (hereinafter referred to as LLC "VTC", the Company) is developed in accordance with the requirements of the Constitution of the Russian Federation, in accordance with Article 18.1 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" (hereinafter referred to as Law No. 152-FZ), other legislative and regulatory legal acts of the Russian Federation in the field of processing and protection of personal data, and is a fundamental internal regulatory document of the Institution, defining the key directions of its activities in the field of processing and protection of personal data.

Main concepts used in the Policy:

Personal data - any information relating to directly or indirectly identified or identifiable individual (personal data subject);
Personal data permitted by the personal data subject for distribution - personal data to which an unlimited number of persons have access, provided by the personal data subject by giving consent to the processing of personal data permitted by the personal data subject for distribution in the manner prescribed by Law No. 152-FZ;
Operator - a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data;
Special categories of personal data include information about the national and racial origin of the subject, about the religious or philosophical beliefs, information about the health and intimate life of the subject, criminal records, etc.;
Processing of personal data - any action (operation) or set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;
Automated processing of personal data - processing of personal data using computer technology;
Distribution of personal data - actions aimed at disclosing personal data to an indefinite number of persons;
Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons;
Blocking of personal data - temporary cessation of the processing of personal data (except in cases where processing is necessary to clarify personal data);
Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed;
Depersonalization of personal data - actions as a result of which it becomes impossible, without using additional information, to determine the belonging of personal data to a specific subject of personal data;
Information system of personal data - a set of personal data contained in databases and providing their processing by information technologies and technical means;
Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to the authority of a foreign state, a foreign individual or a foreign legal entity.

Legal grounds for the processing of personal data by the Company are:

The Constitution of the Russian Federation;
The Labor Code of the Russian Federation;
The Civil Code of the Russian Federation;
The Tax Code of the Russian Federation;
The Budget Code of the Russian Federation;
Federal Law of December 15, 2001 No. 167-FZ "On Mandatory Pension Insurance in the Russian Federation";
Federal Law of July 16, 1999 No. 165-FZ "On the Basics of Mandatory Social Insurance";
Federal Law of July 24, 1998 No. 125-FZ "On Mandatory Social Insurance against Accidents at Work and Occupational Diseases";
Resolution of the Government of the Russian Federation of November 27, 2006 No. 719 "On Approval of the Regulation on Military Registration";
Order of the Federal Service for Supervision of Communications, Information Technology and Mass Media of February 24, 2021 No. 18 "On Approval of the Requirements for the Content of Consent to the Processing of Personal Data Permitted by the Subject of Personal Data for Distribution";
The Charter of LLC "VTC";
Contracts concluded between LLC "VTC" and the personal data subject;
Consent of the personal data subject to the processing of their personal data;
Agency agreements;
Other legal documents.

The Society processes personal data for the following purposes:

Compliance with the legislation of the Russian Federation in the implementation of labor relations: accounting, tax, and personnel records;
Staff recruitment for vacant positions of the Company;
Interaction with counterparties within the framework of civil contracts;
Interaction with individuals within the scope of providing the services "Feedback," "Request a Call," and "Place an Order" through the official website (https://edavdom64.ru/, https://ptksaratov.ru/).

Processing of personal data by the Company is carried out on the basis of points 1, 2, 4, 5 of Part 1 of Article 6, on the basis of point 2.3 of Part 2 of Article 10, on the basis of Part 2 of Article 11 of Law No. 152-FZ:

processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data;
processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to perform and fulfill the functions, powers, and duties imposed on the Company by the legislation of the Russian Federation;
processing of personal data is necessary for the performance of a contract, the party to which or the beneficiary or guarantor under which is the personal data subject, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be the beneficiary or guarantor. The contract concluded with the personal data subject cannot contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors, unless otherwise provided by the legislation of the Russian Federation, as well as provisions allowing as a condition for concluding a contract the inaction of the personal data subject;
processing of personal data is carried out in accordance with the legislation on state social assistance, labor legislation, and pension legislation of the Russian Federation;

The content and scope of processed personal data correspond to the stated processing purposes:

Compliance with the legislation of the Russian Federation in the implementation of labor relations: accounting, tax, and personnel records. List of processed personal data:

surname, first name, patronymic;
date and place of birth;
data of the identity document (series, number, date of issue, issuing authority, department code);
address of registration and actual residence;
nationality;
gender;
contact phone number;
marital status;
individual taxpayer identification number (INN);
information from the document confirming registration in the individual (personalized) account system about the insurance number of the individual personal account (SNILS);
data from the driver's license (for employment of car drivers);
information about military registration (for conscripts and persons subject to military service);
information about education, qualification improvement, professional training;
data on marriage registration (in case of a name change);
information about employment, including awards, rewards, and (or) disciplinary actions;
data on passed certification;
information about vacations granted;
information about salary deductions;
data on social benefits;
data on tax deductions;
data from birth certificates of children;
banking details necessary for settlements with employees;
data from incapacity certificates;
information from a certificate confirming the establishment of disability, issued by federal state institutions of medical and social expertise (in case of disability determination for an employee) (special categories of personal data);
other personal data provided by employees for the implementation of the labor legislation of the Russian Federation.

Categories of personal data subjects:

Employees of the Company;
Former employees of the Company.

Legal grounds for the processing of personal data:

Processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data;
Processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to perform and fulfill the functions, powers, and duties imposed on the Company by the legislation of the Russian Federation;
Processing of special categories of personal data is carried out in accordance with the legislation on state social assistance, labor legislation, and pension legislation of the Russian Federation.

List of actions with personal data:

Collection;
Recording;
Systematization;
Accumulation;
Storage;
Clarification (updating, modification);
Extraction;
Use;
Transfer (provision, access);
Blocking;
Deletion;
Destruction.

Methods of processing personal data: mixed, with transmission through the internal network of the Company, with transmission through the Internet.

Staff recruitment for vacant positions of the Company. List of processed personal data:

Surname, first name, patronymic;
Gender;
Nationality;
Date of birth;
Contact details (contact phone number, email address);
Information about education, work experience, qualification;
Other personal data provided by candidates in resumes and cover letters.

Categories of personal data subjects:

Applicants.

Legal grounds for the processing of personal data:

Processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

List of actions with personal data:

Collection;
Accumulation;
Storage;
Use;
Destruction.

Methods of processing personal data: mixed, with transmission through the internal network of the Company, with transmission through the Internet.

Interaction of the Company with counterparties within civil law contracts. List of processed personal data:

Surname, first name, patronymic;
Date of birth;
Data of identity document (series, number, issue date, issuing authority, department code);
Registered address;
Legal and mailing address;
Main state registration number of the individual entrepreneur (OGRNIP);
Information from the certificate of tax registration (TIN);
Position;
Bank account number, bank name;
Contact phone number;
Email address.

Categories of personal data subjects:

Representatives of legal entities;
Individual entrepreneurs;
Individuals.

Legal grounds for the processing of personal data:

Processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to carry out and fulfill the functions, powers, and duties imposed by the legislation of the Russian Federation on the Company;
Processing of personal data is necessary for the performance of a contract, of which the data subject is a party, beneficiary, or guarantor, or for the conclusion of a contract at the initiative of the data subject or a contract under which the data subject will be a beneficiary or guarantor. A contract concluded with the data subject cannot contain provisions restricting the rights and freedoms of the data subject, establishing cases of processing personal data of minors unless otherwise provided by the legislation of the Russian Federation, as well as provisions allowing inaction of the data subject as a condition for concluding a contract.

List of actions with personal data:

Collection;
Recording;
Accumulation;
Storage;
Clarification (updating, changing);
Extraction;
Use;
Destruction.

Methods of processing personal data: mixed, with transmission through the internal network of the Company, with transmission through the Internet.

Interaction of the Company with individuals within the provision of the service "Feedback," "Request a Call," "Place an Order" through the official website (https://edavdom64.ru/, https://ptksaratov.ru/). List of processed personal data:

Surname, first name, patronymic;
Email address;
Contact phone number;
Registered address or place of residence.

Categories of personal data subjects:

Individuals who requested the service "Feedback," "Request a Call," "Place an Order."

Legal grounds for the processing of personal data:

Processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

List of actions with personal data:

Collection;
Systematization;
Accumulation;
Storage;
Clarification (updating, changing);
Blockage;
Use;
Deletion;
Destruction.

Methods of processing personal data: mixed, with transmission through the internal network of the Company, with transmission through the Internet.

Storage of personal data by the Company is carried out in a form that allows identifying the data subject for no longer than necessary to achieve the purposes of their processing in accordance with the storage periods determined by the legislation of the Russian Federation and the regulatory documents of the Company:

The storage period of personal data of employees of LLC "PTK," former employees contained in orders on personnel matters, in personal files of employees, is 50 years;
The storage period of personal data of employees of LLC "PTK," former employees contained in business trip orders, vacation orders, is 5 years;
The storage period of personal data of employees of LLC "PTK," former employees contained in orders imposing disciplinary sanctions is 3 years;
The storage period of personal data of job applicants to LLC "PTK," contained in resumes, is determined by the period indicated by the candidates in the consent to the processing of personal data;
The storage period of personal data of individuals who contacted LLC "PTK" for the service "Feedback," "Request a Call," "Place an Order" through the official website (https://edavdom64.ru/, https://ptksaratov.ru/), is 30 calendar days;
The storage period of personal data entered into the information systems of the Company corresponds to the storage period of documents on paper carriers containing the relevant personal data.

The Company ensures separate storage of personal data on different material carriers, the processing of which is carried out for various purposes defined by this Policy.

The processed personal data are subject to destruction or anonymization upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by federal law.

When processing personal data, the Company uses databases located in the territory of the Russian Federation, in accordance with part 5 of article 18 of Law No. 152-FZ.

The Company has the right to transfer personal data to investigative and law enforcement agencies, other authorized bodies on the grounds provided by the current legislation.

The Company does not carry out cross-border transfer of personal data.

When processing personal data, the Company takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access to them, destruction, alteration, blocking, copying, provision, dissemination of personal data, as well as from other illegal actions with personal data.

In case of detection of unauthorized processing of personal data by the Company upon the request of the data subject or his representative or at the request of the data subject or his representative or the authorized body for the protection of the rights of personal data subjects, the Company is obliged to block unlawfully processed personal data related to this data subject or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the Company) from the moment of such request or receipt of the specified request for the period of verification. In case of detection of inaccurate personal data upon the request of the data subject or his representative or at their request or at the request of the authorized body for the protection of the rights of personal data subjects, the Company is obliged to block personal data related to this data subject or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the Company) from the moment of such request or receipt of the specified request for the period of verification, if the blocking of personal data does not violate the rights and legitimate interests of the data subject or third parties.

In case of confirmation of the fact of inaccuracy of the processed personal data, the Company based on the information provided by the data subject or his representative, or the authorized body for the protection of the rights of personal data subjects, or other necessary documents is obliged to specify personal data or ensure their clarification (if the processing of personal data is carried out by another person acting on behalf of the Company) within seven working days from the date of submission of such information and remove the blocking of personal data.

In case of detection of unauthorized processing of personal data carried out by the Company or a person acting on behalf of the Company, the Company within a period not exceeding three working days from the date of such detection is obliged to terminate the unauthorized processing of personal data or ensure the termination of unauthorized processing of personal data by a person acting on behalf of the Company. If it is impossible to ensure the lawfulness of personal data processing, the Company within a period not exceeding ten working days from the date of detection of unauthorized processing of personal data is obliged to destroy such personal data or ensure their destruction. The Company is obliged to notify the data subject or his representative of the elimination of the violations committed or of the destruction of personal data, and in case the data subject or his representative's request or the request of the authorized body for the protection of the rights of personal data subjects was sent by the authorized body for the protection of the rights of personal data subjects, also to the specified body.

In case of establishing the fact of unauthorized or accidental transfer (provision, dissemination, access) of personal data resulting in the violation of the rights of data subjects, the Company is obliged from the moment of detecting such incident by the Company, the authorized body for the protection of the rights of personal data subjects, or any other interested party to notify the authorized body for the protection of the rights of personal data subjects:

within twenty-four hours about the incident, the presumed causes leading to the violation of the rights of personal data subjects, the presumed harm caused to the rights of personal data subjects, the measures taken to eliminate the consequences of the incident, and provide information about the person authorized by the Company to interact with the authorized body for the protection of the rights of personal data subjects regarding the issues related to the detected incident;

within seventy-two hours about the results of the internal investigation of the detected incident, as well as provide information about the persons whose actions led to the detected incident (if any).

Upon achieving the purposes of personal data processing, the Company terminates the processing of personal data or ensures its termination (if the processing of personal data is carried out by another person acting on behalf of the Company) and destroys personal data or ensures its destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of achieving the purposes of personal data processing, unless otherwise provided by the contract, the counterparty or guarantor of which is the data subject, or by another agreement between the Company and the data subject, or if the Company is not entitled to process personal data without the consent of the data subject on the grounds provided by federal laws.

In case the data subject withdraws their consent to the processing of their personal data, the Company is obliged to terminate their processing or ensure the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of the Company). If the retention of personal data is no longer required for the purposes of processing personal data, the Company must destroy personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of receipt of the withdrawal, unless otherwise provided by the contract, the counterparty or guarantor of which is the data subject, or by another agreement between the Company and the data subject, or if the Company is not entitled to process personal data without the consent of the data subject on the grounds provided by federal laws.

In case the data subject applies to the Company with a demand to cease the processing of personal data, the Company is obliged, within a period not exceeding ten business days from the date of receipt by the Company of the relevant demand, to terminate their processing or ensure the termination of such processing (if such processing is carried out by a person processing personal data), except for the cases provided for in paragraphs 2-11 of part 1 of article 6, part 2 of article 10, and part 2 of article 11 of Law No. 152-FZ. This period may be extended, but not more than five business days, in case the Institution sends to the data subject a motivated notification indicating the reasons for extending the deadline for providing the requested information.

This Policy is an open document and is intended for acquaintance by an unlimited number of persons. The electronic version of the current edition of the Policy is publicly available on the official website of LLC "PTK" on the Internet (https://edavdom64.ru/, https://ptksaratov.ru/).

Employees of the Company who violate the norms regulating the processing and protection of personal data bear responsibility as provided by the legislation of the Russian Federation, the local acts of the Institution, and the contracts regulating the legal relations of the Institution with third parties.